The EU has established itself as a leading actor in the field of data protection and privacy with the General Data Protection Regulation (GDPR) entering into effect in spring 2018, replacing the outdated 1995 Data Protection Directive, and enshrining the protection of “European data subjects“ everywhere. Further legislation, on e-privacy and trade secrets protection, aspires to expand the EU‘s role as innovative regulator. But daunting questions remain: how to balance privacy and transparency in whistleblower protection? And how to retain the EU‘s role as global rule-maker in the face of thriving digital economies in the Silicon Valley and East Asia?